Software Review McAfee Protection (Plus Plans, Total Protection, LiveSafe)

[Nightwalker]

The update came in just a bit later for me. It does seem unusual that updating the antivirus module and others didn't even require a restart. Smooth as silk!

Same nice experience here, I was traveling and just today I turned my computer on and a bit later McAfee auto upgraded to last version with no nags and no restart required.

 

[Sorrento]

I gave the VPN a try a couple of weeks ago & it was OK, not the fastest VPN there is but useable, I reverted back to my usual one after the test though - Some may find it perfectly adequate.

 

[Trident]

2 new patents granted to McAfee:

Feature	Patent 12,361,128 ("Malware Detection via Screen Capture")	Patent 12,368,725 ("Malicious Activity Alerts on IoT")
Assignee	McAfee, LLC	McAfee, LLC
Core Concept	To detect malware, specifically malicious macros, by visually analyzing a screen capture of an application rather than analyzing the underlying code.	To present security alerts on various Internet of Things (IoT) devices on a network to make them more noticeable and effective.
Mechanism	1. A screen capture of an application is taken when a macro is initiated.2. The captured image is compared against a database of known malicious images using similarity analysis.3. If inconclusive, Optical Character Recognition (OCR) is used to analyze text on the screen for suspicious phrases.4. If a match is found, the system takes responsive action (e.g., terminates the process).	1. Malicious activity is detected on a device connected to a network.2. The system intelligently selects a nearby IoT device (e.g., smart speaker, light bulb) to present the alert.3. The alert is customized to the capabilities of the selected device (e.g., sound, light).4. In some cases, an alert can trigger automated security measures on other networks.
Problem Solved	Addresses the challenge of detecting obfuscated or encrypted malware that is difficult to identify through traditional code signature analysis.	Overcomes the issue of "alert fatigue," where critical security notifications on a primary device may be missed or ignored by the user.
Novelty & Significance	The innovation lies in its visual, behavioral approach to threat detection. By focusing on the rendered output of a macro, it can identify threats even if their code is completely hidden or polymorphic, adding a crucial heuristic layer to endpoint security.	The patent's novelty is in transforming security alerts from isolated notifications into environmental, attention-grabbing events. It leverages the existing ecosystem of smart devices to create a more pervasive and user-centric alert system.

Malware Detection via Screen Capture targets these “enable macro” documents that use images to lure the user. McAfee uses image and text-in-the-image analysis to detect the document, rather than relying just on the macro detection.

Malicious activity alerts on IoT probably paves the way for some sort of smart speaker integration (Alexa/Google Home).

 

[Trident]

This is the prompt/lalert when malware tries to connect to suspicious domains. Remediation is triggered as well, even if antivirus is off,

 

[piquiteco]

This is the prompt/lalert when malware tries to connect to suspicious domains. Remediation is triggered as well, even if antivirus is off,
View attachment 290167

And is the malicious activity still trying to open PowerShell? Interesting...

 

[Trident]

And is the malicious activity still trying to open PowerShell? Interesting...

I had to turn off the AV to get this warning, otherwise the malicious macro was getting detected and traced back to the document. I specifically wanted to see this warning.

 

[Parkinsond]

This is the prompt/lalert when malware tries to connect to suspicious domains. Remediation is triggered as well, even if antivirus is off,
View attachment 290167

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

 

[harlan4096]

View attachment 290168

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

 

[SeriousHoax]

View attachment 290168

Kaspersky Threat Intelligence Portal

Kaspersky Threat Intelligence Portal allows you to scan files, domains, IP addresses, and URLs for threats, malware, viruses

opentip.kaspersky.com

 

[Parkinsond]

View attachment 290169

Yes, I have seen it.
The domain blocked by McAfee is classified safe by Kaspersky threat intelligence portal.

 

[Parkinsond]

View attachment 290170View attachment 290171

Must be false negative by Kaspersky; unreliable.

 

[Trident]

There were few other domains, will post them shortly. The macro iterates few domains, when it can’t connect to one, it tries another.

 

[piquiteco]

I had to turn off the AV to get this warning, otherwise the malicious macro was getting detected and traced back to the document. I specifically wanted to see this warning.

Even if I disabled McAfee and had Java installed and ran the Ikov.jar file, it would be blocked via SRP. I'm not stupid, I take plenty of precautions in case the AV fails.

Spoiler

 

[Trident]

 

[harlan4096]

riandutra . com -> looks like had malware some years ago, now redirects to other site, so probably not active with malware anymore.

Same as santyago . com, none of those 3 are probably active with malware now, maybe had in the past but...

 

[Trident]

The domains are not used to measure effectivness and compare to others, I was curious about the alert and behaviour of the firewall. Kaspersky may block these domains in the context of the attack. The opentip and VT are not indicators.

 

[piquiteco]

@Trident Does McAfee rely on WebView to function?

 

[Trident]

@Trident Does McAfee rely on WebView to function?

Yes, the interface is based on WebView. McAfee supplies their own WebView component. The UI awfully looks like an Angular dashboard.
It could also be React, but unlikely.

angular dashboard - Bing

Intelligent search from Bing makes it easier to quickly find what you’re looking for and rewards you.

www.bing.com

 

[piquiteco]

Yes, the interface is based on WebView. outlook supplies their own WebView component. The UI awfully looks like an Angular dashboard.
It could also be React, but unlikely.

Okay, I understand. Do you know if Outlook for Windows has anything to do with WebView? I'm asking because my Outlook won't open now after I uninstalled McAfee. I hadn't opened it yet, but today when I tried to open it, I got an error saying the image was corrupted. I looked in the C:\Program Files (x86) folder and in the installed programmes, and WebView is not listed as installed. I don't know if it was a coincidence or not, but Outlook won't open. It even loads the Outlook icon in the tray, but it doesn't go beyond that, and you can't close it either. No problem, this can be fixed, I just wanted to know if Outlook for Windows depends on WebView to work.

Spoiler

 

[Trident]

Okay, I understand. Do you know if Outlook for Windows has anything to do with WebView? I'm asking because my Outlook won't open now after I uninstalled McAfee. I hadn't opened it yet, but today when I tried to open it, I got an error saying the image was corrupted. I looked in the C:\Program Files (x86) folder and in the installed programmes, and WebView is not listed as installed. I don't know if it was a coincidence or not, but Outlook won't open. It even loads the Outlook icon in the tray, but it doesn't go beyond that, and you can't close it either. No problem, this can be fixed, I just wanted to know if Outlook for Windows depends on WebView to work.

Spoiler

View attachment 290174

These UWP apps are fully contained. So any error is likely inside the app… you may need to reinstall the app. I think Edge WebView is under components…